Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

W97M/Footer.A

W97M/Footer.A is a macro virus operating in the Microsoft Word 97 environment. It attacks active documents and the global template normal.dot. The attacked document has property FootPrint1 with value Yes added to the document properties.
When an infected document is opened the virus exports its code into the files c:\footprint.$$$ and c:\footprint.$$1. Then it attacks the global template and the active document. The virus imports its code from the file c:\footprint.$$1 and saves it in the document area reserved for heading and foot of the document.
The virus attacks documents when a new document is created and when it is opened. Upon closing the attacked document the virus deletes the both created temporary files. To identify infected documents the virus inserts the property FootPrint1 into file properties into section Own and sets its value to Yes. In the window Document properties it looks as follows:

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.